If you manage IT for a small business, you've felt this whiplash: a headline screams "CRITICAL VULNERABILITY" with a CVSS score of 9-point-something, and you have no idea if that means cancel your weekend or add it to next Tuesday's to-do list. The Reddit discussion around the recent PHP remote code execution flaws captured this exact pain point perfectly — security pros were debating urgency in real time, while everyone else was left wondering how to tell the difference.
Good news: the last two weeks handed us a perfect, real-world case study in exactly this problem. Let's walk through it.
Act One: The Genuine Emergency
On October 21, 2026, the PHP project disclosed CVE-2026-109618 and CVE-2026-109619, a pair of remote code execution flaws with a CVSS score of 9.4. According to Krebs on Security, these flaws affected roughly 70% of websites running on PHP, and working exploits were already circulating before most organizations even knew patches existed.
SANS ISC raised its InfoCon status to YELLOW for these CVEs — a signal reserved for issues the security community considers widespread and actively dangerous. Bruce Schneier's blog independently confirmed the severity, which matters because when multiple respected, unaffiliated sources converge on the same urgency level, that's a strong signal the threat is real, not hype.
This is what a true drop-everything CVE looks like: high CVSS score, broad deployment footprint, and public proof-of-concept exploits before most people patched. If you're running PHP anywhere in your stack, this was a weekend-ruiner, and rightly so.
Act Two: The Nuance
Two days later, The Hacker News reported millions of exploit attempts against these same flaws — attackers racing to deploy Mirai-style botnet malware. But here's the twist: the exploitation turned out to be harder to pull off at scale than the initial panic suggested. A high CVSS score tells you how bad things could get if exploitation succeeds; it does not automatically tell you how easy that exploitation actually is in your specific environment.
This is the nuance most small business owners never learn: CVSS measures potential impact and exploitability in general terms, not your actual exposure. A 9.4 on a system that's internet-facing, unpatched, and running the default configuration is an emergency. The same CVE on a system behind a firewall, with limited exposure, is still serious — just not necessarily a 2 a.m. page.
Act Three: The Stand-Down
Just two days after the emergency PHP2Shell patches, The Hacker News reported a second PHP RCE, CVE-2026-115560. Same vendor, same vulnerability class, disclosed in the same week. But this one got no emergency patch, and was assessed as low risk due to the narrow conditions required to exploit it.
Same headline shape. Completely different urgency. That contrast is the whole lesson.
A Simple Decision Framework
Instead of reacting to every "critical CVE" headline, run new vulnerabilities through four questions:
- Is it actually in your environment? Check your asset inventory before you panic. If you don't have one, our guide to top free tools to track CVEs for small business is a good starting point.
- Is there a public exploit or active exploitation? CVSS score alone doesn't tell you this — check vendor advisories, SANS ISC, or CISA's Known Exploited Vulnerabilities catalog.
- Is the affected system exposed to the internet or otherwise high-value? An internet-facing server with this flaw is a different risk than an internal workstation.
- What's the actual exploit complexity? "Critical" plus "trivial to exploit" plus "internet-facing" equals drop everything. "Critical" plus "requires authenticated local access" is a scheduled patch, not a fire drill.
If you answer yes to the first three, that's your drop-everything signal — patch immediately, even outside your normal maintenance window, the same logic we outlined in our piece on the cost of skipping critical patches on Windows Server. If the answers are mostly no, log it, schedule it, and move on with your week.
This is also exactly why routine, automated vulnerability scanning matters more than reading every security headline. A scan tells you, in plain terms, which of these CVEs actually exist in your environment — which is the real question underneath all the CVSS score anxiety. For a deeper look at how scanning differs from a full penetration test, see our breakdown of vulnerability scanning vs. penetration testing.
Take Action
You can't build a reliable patch-priority framework if you don't know what's actually running in your environment. Proactive scanning catches these exposures before attackers do, turning "is this CVE relevant to me?" from a guessing game into a factual answer.
Oscar Six Security's Radar scan is a fast, affordable way to find out — for $99, you get a clear picture of what's exposed and what needs attention first. Check out our solutions and stop reacting to headlines. Focus Forward. We've Got Your Six.